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Abstract 

The fault detection and accommodation (FDA) 

FTITB 

" 

fan-turbine-inlet temperature, 
B channel, °F 

methodology for digital engine-control systems may 
range from simple comparisons of redundant param- 
eters to the more complex and sophisticated 

FTITSYN 

- 

synthesized-fan-turbine-inlet 
temperature, °F. 

observer models of the entire engine system. 
Evaluations of the various FDA schemes are done 

HP 


pressure altitude, ft 

using analytical methods, simulation, and limited- 
altitude-facility testing. Flight testing of the 

I/M 

= 

intermediate power setting 

FDA logic has been minimal because of the diffi- 
culty of inducing realistic faults in flight. A 

LOD 

= 

light-off detector 

flight program was conducted to evaluate the fault 
detection and accommodation capability of a digi- 

M 

= 

Mach number 

tal electronic engine control in an F- 1 5 air- 
craft. The objective of the flight program was to 

N1 

= 

fan rotor speed, rpm 

induce selected faults and evaluate the resulting 
actions of the digital engine controller. Com- 

NIC 

= 

corrected fan rotor speed, rpm 

parisons were made between the flight results and 
predictions. Several anomalies were found in 
flight and during the ground test. Simulation 

N2 

- 

core rotor speed, rpm 
(100? N2 = 14,000 rpm) 

results showed that the inducement of dual- 
pressure failures was not feasible since the FDA 

N2C 

= 

corrected core rotor speed, rpm 

logic was not designed to accommodate these types 
of failures. In general, the flight results 

PB 

= 

p 

burner pressure, lb/in 

compared well with the ground tests and predic- 
tions. The techniques used to induce selected 
failures in the flight environment were effective 

PBSYN2 

— 

burner pressure synthesized from 
station 2 pressure, lb/in 2 

in evaluating the FDA logic. 

PBSYN6 

s 

burner pressure synthesized from 
station 6 pressure, lb/in 2 

Nomenclature 

PLA 

= 

power lever angle, 0 

AJ = jet primary nozzle area, sq ft 

PS2 

= 

p 

fan-inlet static pressure, lb/in 

BUC = hydromechanical backup control 

CIVV = compressor inlet variable vane 

PS2SYN 

' 

synthesized fan inlet static 
pressure, lb/in 2 

DEEC = digital electronic engine control 

PS6 

“ 

turbine-discharge static pressure, 
lb/in 2 

EPR = engine pressure ratio, PT6M/PT2 

PT2 

= 

inlet total pressure, lb/in 2 

FDA = fault detection and accommodation 

FTIT = fan-turbine-inlet temperature, °F 

PT6M 

= 

turbin-discharge total pressure, 
lb/in 2 (mixed core and fan stream) 

FTITA = fan-turbine-inlet temperature. 

RCVV 

= • 

rear-compressor variable vane 

A channel, °F 

TT2 

= 

fan-inlet total temperature, °F 

*Propulsion engineer. Member AIAA. 
fProject engineer. Member AIAA. 

WFGG 

= 

gas-generator fuel flow, lb/hr 


^Senior test engineer 
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Introduction 


Airplane Description 


The detection and accommodation of faults is 
a vital feature of digital engine-control 
systems. The methodology for fault detection and 
accommodation (FDA) may range from simple compari- 
sons of redundant parameters to the more complex 
and sophisticated observer models of the entire 
engine system (Refs. 1, 2, and 3). System faults 
may exist in sensors, actuators, electronics com- 
putation, wiring or data links. Detection of 
these faults may be accomplished by either redun- 
dant measurements or synthesized parameters, using 
either digital and/or analog logic. The accom- 
modation may consist of using redundancy or alter- 
nate control modes, inhibiting certain functions, 
or transferring to a dissimilar control, as 
discussed in Ref. 1. 

The National Aeronautics and Space Adminis- 
tration (NASA), Air Force, Navy and several engine 
manufacturers are conducting various studies of 
existing and projected engine-control systems to 
investigate the capability and performance of 
various FDA schemes. These studies have made 
extensive use of analytical methods and simula- 
tions. Limited altitude testing in support of 
these studies has also been accomplished. With 
the advancement of the full-authority, digital, 
engine-control systems, and their commitment to 
production, there has been an increasing need to 
perform in-flight evaluations of the FDA method- 
ology for substantiating the predictions and 
facility results of the studies. However, the 
difficulty of inducing realistic faults in flight 
has limited flight testing of the FDA logic. 

To attempt to satisfy this need, NASA Ames 
Research Center's Dryden Flight Research Facility 
has recently conducted the first flight tests in 
which faults were intentionally introduced into a 
digital engine-control system. The objectives of 
the flight program were twofold; first, to intro- 
duce selected faults and evaluate the resulting 
actions of the digital engine controller, and 
second, to evaluate the concept of in-flight FDA 
testing. 

The FDA testing was accomplished on an F-15 
airplane powered by engines equipped with a digi- 
tal electronic engine control (DEEC) system 
(Ref. 4). The DEEC is a full-authority, single- 
channel digital control with selected redundancy 
to maintain digital gas-generator control for any 
single input-output failure. It also incorporates 
a simple, hydromechanical backup control. The 
approach used in the FDA testing was not to modify 
DEEC software and hardware; instead, failures were 
simulated by interrupting sensor signals with 
switches and valves. This paper describes the 
engine, the DEEC, the FDA methodology and logic, 
flight test techniques and procedures, and flight 
results. 


The F-15 airplane (Fig. 1 ) is a high- 
performance, twin-engine fighter, capable of 
speeds to Mach 2.5. The engine inlets are of the 
two-dimensional external compression type with 
three ramps, and feature a variable capture 
area. The F-15 is powered by two 
F100-PW-100 engines. 


Engine Description 

The F100-PW-100 engine (Fig. 2) is a twin- 
spool, afterburning turbofan with a low bypass 
ratio (0.8). The three-stage fan is driven by a 
two-stage, low-pressure turbine. The 10-stage, 
high-pressure compressor is driven by a two-stage, 
high-pressure turbine. The engine incorporates 
compressor-inlet variable vanes (CIVV) and rear- 
compressor variable vanes (RCVV) to achieve high 
performance over a wide range of power settings; a 
compressor bleed is used only for starting. Con- 
tinuously variable thrust augmentation is provided 
by a mixed-flow augmentor, which is exhausted 
through a variable-area convergent-divergent 
nozzle. The augmentor incorporates five spray- 
ring segments which come on sequentially. Seg- 
ments 1, 2, and 4 are located in the core stream, 
and segments 3 and 5 are located in the fan-duct 
stream. 


Engine Control System 

The DEEC is a full-authority, engine-mounted, 
fuel-cooled system that performs the functions of 
the standard F100 engine's hydromechanical, uni- 
fied fuel control and the supervisory engine elec- 
tronic control. The DEEC consists of a single- 
channel digital controller with selective input- 
output redundancy, and a simple, hydromechanical 
backup control (BUC). The DEEC system is shown in 
Fig. 3. It receives inputs from the airframe 
through throttle position (PLA) and Mach number 
(M), and from the engine through pressure sensors 
(fan-inlet static pressure (PS2), burner pressure 
(PB), and turbine-discharge static pressure 
(PT6M) ) , temperature sensors (fan-inlet total 
temperature (TT2) and fan-turbine-inlet 
temperature (FTIT)), and rotor speed sensors (N1 
and N2), and the ultraviolet flame sensor (LOD). 

It also recives feedback from the controlled 
variables through position-feedback transducers 
indicating CIVV, RCVV positions, metering-valve 
positions for gas-generator fuel flow ( WFGG ) , 
augmentor-core and duct-fuel flow, segment- 
sequence valve position, and exhaust nozzle 
position (AJ). Dual sensors and position 
transducers are used as shown to achieve 
redundancy in key parameters, such that no single 
input-output failure will cause loss of digital 
gas-generator control. 

The input information is processed by the 
DEEC computer to schedule the variable vanes to 
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gas-generator and augmentor fuel flows, to posi- 
tion the augmentor segment-sequence valve, and to 
control exhaust nozzle area. 

DEEC Engine Fault-Protection System 

The function of the fault protection system 
for the DEEC is to provide additional engine 
safety and operation in the event of an engine- 
control-system failure. It can detect and iden- 
tify 160 faults within the control system. The 
FDA logic provides three basic levels of engine 
operation in the event of an engine-control-system 
anomaly. The first level maintains normal engine 
operation with notification that a failure of a 
redundant parameter has occurred. The second 
level also maintains normal operation of the gas 
generator, but inhibits afterburner operation. 

The third level of accommodation is to automati- 
cally transfer control of the engine to the backup 
control. Although the FDA logic uses relatively 
straightforward methods compared to some of the 
sophisticated Kalman-Bucy filter methods of 
Ref. 3, it comprises 40/S of the DEEC control 
logic . 

FDA Logic 

The DEEC system shown in Fig. 3 incorporates 
significant fault-detection and accommodation 
logic. Part of the FDA methodology which is used 
in the DEEC system is reflected in the amount of 
redundancy of the system. Dual sensors and posi- 
tion transducers are used to achieve redundancy in 
key parameters such as engine speeds, tempera- 
tures, throttle position, and RCVV. Dual-wound 
coils are used in the torque motor drivers for all 
actuators, except the nozzle actuator. Nonredun- 
dant, less-critical parameters are pressures, 
augmentor fuel flow, nozzle area, CIVV, LOD, and 
aircraft Mach number. 

The selective input/output redundancy allows 
the system to maintain gas-generator control with 
any single input/output failure. The control 
detects hard and soft failures of the dual 
sensors. Hard failures are declared when a sensor 
exceeds Its maximum or minimum expected values. 
Soft failures are detected when the two signals 
disagree by more than a predetermined tolerance; 
the more conservative (safer) sensor value is then 
used. The pressure sensors PS2, PB, and PT6M are 
not redundant, but can be synthesized from any one 
of the other two pressures. Failure of any nonre- 
dundant sensor will result in a loss of augmentor 
capability. Second failures of the dual sensors 
will trigger an automatic transfer to BUC, as will 
failures in the DEEC computer internal checks. 


FDA Levels 

The three FDA levels in DEEC software are 
shown in Fig. 4. When the DEEC is operating 


without faults, the level of FDA activity is 
normal (represented by the top box of the 
figure). The next level down occurs when the 
first fault is detected and one of two possible 
fault accommodations can take place. One possi- 
bility is to accommodate the fault internally in 
the DEEC processor, and the second is to transfer, 
to the backup control system. The decision to 
transfer to BUC is based on one of three possible 
detected conditions: (1) the DEEC processor has 

detected a fault which will not allow the 
processor to control gas-generator fuel flow or 
schedule RCVV position; (2) the engine-protection 
logic (overspeed, overtemperature) has detected a 
variable (N1, N2, or FTIT) that either is over the 
limit or will reach an over-limit condition at its 
current rate; (3) an independent fan-speed (N1) 
logic in the DEEC processor has detected an 
overspeed . 

Other faults at this detection level drop 
down to the accommodation level if one of four 
engine operating conditions is selected depending 
on the fault. The accommodation level which 
replaces redundant sensor faults one-for-one, 
gives a normal engine operation. If the fault is 
within the augmentor control of segments III or 
IV, these segments are inhibited. If the fault is 
more inclusive in the augmentor control, then 
engine augmentation is completely inhibited. If 
the synthesis of PB is required and a 'like' fault 
occurs, the DEEC processor automatically transfers 
engine control to the hydromechanical backup con- 
trol. Table 1 shows the sensor faults of impor- 
tance for this paper detectable by the DEEC FDA 
logic and the resulting actions. 

Nonredundant sensor logic 

The three pressure sensors, PS2, PB, and PT6M 
are not redundant. The PS2 sensor is used in the 
fan-speed request, nozzle-area request and trim- 
ming, and the engine pressure ratio, PT6M, PT2 
(EPR) request and feedback logic. A declared 
failure of the PS2 sensor causes the DEEC to use a 
synthesized PS2 based on corrected engine speed, 
engine inlet temperature, and burner pressure 
(Fig. 5). In this mode, augmentor and nozzle-area 
trim functions of the engine are inhibited by the 
DEEC. In addition, the soft, failure-detection 
logic for burner pressure is bypassed. 

Burner pressure is a critical parameter 
because it is used in the scheduling of the gas- 
generator fuel flow and in the stall detection 
logic. As with the PS2, detected failures of the 
PB cause a synthesized value to be substituted. 
When the PB is failed, there is no stall detection 
and augmentation is inhibited. The DEEC processor 
continuously synthesizes the PB from the PS2, TT2, 
and corrected core rotor speed, N2C; and also from 
the PT6M, TT2, and corrected fan rotor speed, NIC 
(Fig. 5). These two synthesized values are com- 
pared to the actual sensed value of the PB. If 
the three values of PB are not within predeter- 
mined tolerances ( 25% steady state and 45? during 
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transients and afterburner operation) then the 
DEEC declares the out-of-tolerance pressure sensor 
to be failed and substitutes the synthesized value 
where applicable, either the PBSYN2, PBSYN6, or 
the PS2SYN. 

The PT6M is used primarily at intermediate 
and afterburner operation as part of the EPR feed- 
back logic, augmentor blowout detection and nozzle 
area trim function. The PT6M is not synthesized 
because it is used for EPR control which is locked 
out for any pressure failure, and because detected 
PT6M failures result in inhibition of the aug- 
mentor and nozzle trim functions and bypassing of 
the PB soft-fail logic. 

Redundant sensor logic 

The critical sensors, TT2, N1, and N2 are 
dual sensors used by the DEEC. The FDA logic 
searches for redundant sensors which are out of 
range, and checks agreement between sensors 
(Fig. 6). If both sensors are in range, the 
sensors are compared. If the sensors agree, the 
values are averaged and used. Disagreement 
between sensors by more than a predetermined 
tolerance causes the higher, or safer, value to be 
used. If either sensor is out of range, the in- 
range sensor is used. If both sensors are out of 
range, the last in-range value is used and the 
control transfers to the BUC. 

For the FTIT, dual signals are available, but 
failure of both signals can be accommodated. As 
shown in Table 1, if both sensors are failed, 
synthesized FTIT values are used and the maximum 
allowable value of N2 is reduced by 1000 RPM. 


FDA Test Philosophy 

For the FDA flight test, failures were intro- 
duced by interrupting sensor signals upstream of 
the DEEC, leaving the DEEC's software logic and 
internal hardware intact. The types of sensor 
failures induced (such as the PB, PS2, CIVV, and 
FTIT) would result in engine operation using DEEC 
synthesized parameters or alternate control 
modes. Failures in the dual critical sensors 
could have been introduced, but would have simply 
resulted in a transfer to the BUC. The sensor 
failures were induced to simulate either wires 
which were broken or pressure lines which were 
plugged or broken. The dynamic engine-simulation 
deck was used to analyze the effects of the 
induced failures at the proposed flight condi- 
tions, prior to the ground and flight tests. It 
was also decided to thoroughly test all proposed 
failures on a ground-test stand prior to flight. 


DEEC FDA Test Schematic 

The DEEC engine was modified to allow 
switches and valves to be installed on the sensor 
lines (Fig. 7). The sensor lines that were modi- 
fied and for which the related FDA logic was 


evaluated were the PS2, PB, CIVV, and FTIT. The 
PS2 sensor line was configured to allow the pres- 
sure to either be trapped (simulating a plugged 
line or iced probe) or be ported to another 
source, PS6 (simulating a broken line). The PB 
sensor line was configured to allow the pressure 
to be trapped or dumped to engine-bay ambient 
pressure (simulating a broken pressure line). 
Switches were installed in the CIVV feedback- 
position transducer wiring and in the Chromel 
circuit of the FTIT thermocouple circuits to 
simulate broken wires. 

Selection of the failure to be induced was 
controlled by switches in the cockpit. The 
configuration of these switches and valves was 
designed so that normal and fail-safe operation 
allowed normal DEEC control. No changes were 
required in the DEEC software, since the faults 
were induced at the sensors. 


FDA Test Conditions 

The test points flown (Fig. 8) were selected 
to concentrate on the subsonic flight conditions 
where most of the engine operation occurs. Sensor 
failures were introduced at steady-state power and 
during throttle transients. Once the failure had 
been introduced, the airplane was flown in forma- 
tion with chase airplanes to evaluate throttle- 
response characteristics. Climbs and accelera- 
tions were also performed after the failure was 
introduced. Single failures and combinations of 
failures were tested. 


Test Results 

Simulation results 

A full nonlinear, aerothermodynamic engine 
simulation was used to predict the engine response 
to the induced failures at both sea-level static 
and at the proposed flight conditions. Simula- 
tions for single failures were first evaluated; 
then dual failures were evaluated. 

The DEEC FDA logic was not designed to accom- 
modate dual pressure failures; however, dual- 
pressure-failure testing was studied. The simula- 
tion results showed that for dual pressure (PS2 
and PB) failures, the engine response could cause 
an overspeed or an engine stall. If the PS2 is 
failed soft (high in range) and PB is failed hard, 
an overspeed potential exists because the synthe- 
sized PB is proportional to the PS2, resulting in 
increased fuel-flow scheduling. The overspeed 
protection logic was found to be adequate to 
prevent a catastrophic overspeed, but would in 
some conditions permit an overspeed that would 
require maintenance action. 

If the PS2 is failed hard, the PB soft- 
failure and stall-detection logic is bypassed; 
therefore a soft failure would not be detected, 
and a potentially dangerous situation could 
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occur. Based on the simulation results, dual 
pressure failures were not evaluated in flight. 
Simulation ! results of the other sensor failures 
(both single and dual) indicated no endangering 
responses . 

Ground test results 

The test engine was installed on a ground- 
thrust stand and all the proposed failures, both 
single and dual combinations, were evaluated. 
Failures were induced and evaluated at steady- 
state power and during throttle transients. Most 
of the faults were correctly detected and 
accommodated . 


In all cases when the PS2 was failed high in 
range (by porting it to the PS6), simulating a 
soft failure, the FDA logic did not detect the 
failure. Pressure failures for the PS2, PB, and 
PT6M are detected by comparing the sensed and 
synthesized values of the PB for these pres- 
sures.. The lack of detection of the PS2 soft 
failure was found to be a ^scaling error in the 
synthesized value of the PB. The PB was scaled to 
a maximum value of 600 lb/in.^ in the DEEC logic, 
with overscale values wrapped around (601 lb/in. 
would erroneously be set to 1 psia, etc.). There- 
fore, the resulting synthesized value of the PB 
from the failed high-PS2 signal was wrapped around 
and was accepted as a good value when evaluated by 
the FDA logic. For example, at intermediate power 
the PB is about 290 lb/in. with the failed high- 
PS2 signal, the synthesized PBSYN2 is three times 
higher than the PB or about 870 lb/in. The 
overscale value would be seen by the DEEC as 
270 lb/in. resulting in no fault detection of 
the failed PS2 sensor. 


Another anomaly was observed when PB was 
failed low [in range during throttle transients 
from idle to intermediate by venting the sensor to 
the engine-bay ambient pressure to simulate a 
broken pressure line. Figure 9 shows the failure 
was not detected and the engine decelerated to a 
subidle condition. Instead of detecting the PB 
failure, the stall detection logic (based on rate 
of PB decrease) detected a false "stall." The 
stall recovery logic reduced the fuel flow so much 
the engine decelerated to a subidle condition. 

The engine would not recover or respond to 
throttle at this condition and had to be shut down 
and restarted. The stall detection and recovery 
logic action was activated to correct the "stall" 
detected by the failed sensor. The failed sensor 
had not been detected because the transient toler- 
ance of 45? between the synthesized and sensed 
values had not been reached prior to the stall 
being detected. 

The FTIT A and B signals were failed, both 
separately and at the same time. When both chan- 
nels were failed (by opening the switches in the 
thermocouple circuit), the internal FTIT driver 
circuit would either drive the signal to 0 or full 
scale from the last good value depending on 


whether the engine was at steady state or in a 
transient condition. In either case, the FDA 
logic detected and accommodated the failure. 

Except as discussed above, the single and 
dual combination failures were properly detected 
and accommodated, and agreed with the simulation 
predictions . 

Flight test results 

In-flight failures were introduced at steady- 
state conditions and during throttle transients. 
Throttle transients were performed by inducing the 
failures before and during the throttle 
movement. Both single and dual failures were 
evaluated. In most cases, the failures were 
detected and accommodated. 

Figure 10 shows a time history of fan speed 
for an idle-to-intermediate power throttle tran- 
sient, first with a normally functioning engine, 
and then with a failed burner-pressure signal, at 
a Mach number of 0.8 and an altitude of 

20.000 ft. The failure was not immediately 
detected because the failed PB signal was within 
the 45? transient tolerance band in the FDA 
logic. When the FDA logic switched to the steady- 
state 25? tolerance, the logic detected the more- 
than-25? error, declared the PB sensor failed, 
and, using PBSYN2, accelerated the engine to 
intermediate power. The engine-dynamic simulation 
of a failed burner pressure is also shown and 
matches the actual engine response fairly closely. 

Figure 11 shows an intermediate power climb 
from 5000 to 30,000 ft with PS2 failed (pressure- 
trapped) at 5000 ft to simulate an iced probe. 

The failure was undetected until an altitude of 

25.000 ft, when the error between PB and PBSYN2 
reached 25?. This is more graphically shown in 
the difference between actual PS2 and failed PS2 
values in Fig. 11. Use of the failed PS2 pressure 
in the control logic during the climb resulted in 
higher-than-normal EPR and lower-than-normal fan- 
stall margin, but no engine problems were noted. 

Figure 12 shows a CIVV failure at 20,000 ft 
and 0.8 Mach number. The failure was induced 
during 'a throttle transient from idle to inter- 
mediate and was detected and accommodated by 
operating the gas generator with the CIVVs in the 
full cambered position. This results in a lower 
fan pressure ratio, hence the lower PB. Again, 
the engine dynamic simulation matches the engine 
response reasonably well. 

Figure 13 shows the effect of a failure of 
both FTIT sensors at Mach 0.8 and an altitude of 

20.000 ft. The FDA logic detected the failure and 
used FTITSYN to monitor FTIT during the snap 
throttle transient from idle to intermediate 
power. The maximum upper N2 limit was reduced by 
1000 rpm but was not a factor at this flight 
condition. 
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Figure 14 shows that PS2 failed high in range 
during a maximum-power aircraft acceleration 
from 0.8M to 1.35M. In this case PS2 was not 
detected as being failed because the error between 
PB and PBSYN2 did not reach the 45$ tolerance 
allowed during afterburner operation. In fact, 
the engine was downtrimming EPR (opening the 
nozzle) to compensate for the false PS2 signal 
resulting in the engine thrust being much lower 
than normal. The open nozzle was predicted by the 
engine-dynamics simulation, but the resulting FTIT 
was considerably lower than the simulation 
prediction. 

Once the sensor failures were detected and 
accommodated, the aircraft was flown in close 
formation with another aircraft to evaluate engine 
response and handling with known sensor 
failures. Pilot comments were favorable; in many 
instances, the engine response was essentially 
unaffected , 

The concept of in-flight FDA testing was 
verified. No problems or safety hazards were 
encountered during the four-flight evaluation. 


Concluding Remarks 

An evaluation of the fault-detection and 
accommodation capability of a digital electronic 
engine control (DEEC) system has been completed at 
NASA Ames-Dryden, The DEEC was installed on an 
F100 engine in the Ames-Dryden F-15 airplane. 

Engine operation with the DEEC synthesized 
parameter modes was accomplished over much of the 
F-15 flight envelope, thereby adding support to 
the DEEC FDA concept. 

Some failures were not detected because of a 
logic error which was not found immediately. The 
lack of detection was found to be a scaling error 
in the synthesized value of PB. 

Based on the engine dynamic simulation 
results, dual pressure failures were not evaluated 
in flight because of the potential for engine 
overspeed and stall. The DEEC FDA logic was not 
designed to accommodate dual pressure failures. 

When PB was failed low to simulate a broken 
line, the failure was not detected. Instead the 
stall detection logic detected a false stall, 
resulting in the engine decelerating to a subidle 
condition. 

In general, the single and dual combination 
failures agreed well with the engine dynamic simu- 
lation predictions. In some cases, pressure 
sensor failures were not detected because of the 
large tolerance allowed between synthesized and 
measured values; this did not result in hazardous 
engine operation. 

Once failures were detected, engine operation 
with the synthesized parameters was excellent. 


Pilots flying in close formation found the engine 
response to be essentially unchanged. Overall, 
the in-flight FDA test concept worked well in this 
first flight evaluation. 
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Table 1 DEEC Fault Accommodation Summary 


Fault-Induced 

Failure 

Action 

CIVV 

Out of range 

CIVV goes full 
cambered (-25°) 
augmentation 
inhibited, AJ 
trim inhibited 

FTITA, FTITB 

Out of range 

Use in-range 
sensor 


Soft in-range 

Use higher 
sensor 


A & B out of 

Use calculated 


range 

FTIT, N2 
maximum 

reduced 1000 rpm 

PS2 

Soft in-range 

AJ trim 
inhibited, 
augmentation 
inhibited, PB 
soft failure 
detect bypassed, 
PS2SYN 

substituted for 
PS2. If PB also 
failed, transfer 
to BUC 

PB 

Soft in-range 

PBSYN2 , 
(calculated) 
substituted for 
PB, augmentation 
inhibited, stall 
detect logic 
bypassed. If 
PS2 also failed, 
transfer to BUC 
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ECN 17691 


Fig. 1 The F~1S airplane used for DEEC FDA flight 
evaluation. 


Static pressure 
probe (PS2) 


Fan turbine 

Augmentor ignitors 
(dual) 



Compressor inlet 
variable vanes 

(CIVV) 


Variable area 
nozzle (AJ) 


Augmentor fuel spray rings 
(5 segments) 
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Fig. 2 Section view of F100 engine used in the 
DEEC FDA flight evaluation. 
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Fig. 3 Schematic of DEEC control system. 
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Fig. 4 Fault-detection and accommodation levels within the DEEC logic. 
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Fig. 5 Nonredundant pressure sensor logic. Fig. 6 DEEC FDA logic for redundant sensors. 
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Fig. 8 DEEC — FDA test points. 
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Fig. 9 Idle-to-intermediate throt- 
tle transient with burner pressure 
failed to ambient. Ground test. 



Fig. 10 idle-to-intermediate throttle snap 
with burner pressure capped at 20,000 ft and 
0.8 M. 




Fig. 11 Intermediate power climb from 5,000 to 
30 ,000 ft with PS2 capped at 5,000 ft. 



Fig. 12 Idle-to-intermediate throttle snap with 
CIVV failed, at 20,000 ft and 0.8 M. 


11 



3.1 r— 




Fig. 13 Idle-to-intermediate throttle snap 
with FTIT failed , at 20 ,000 ft and 0.8 M. 



AJ, 
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Fig. 14 Maximum power acceleration at 30,000 ft 
with PS2 failed ( capped ) at 0.8 M. 
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